package proofedmesh.transformations.expense_test

import data.proofedmesh.transformations.expense
import rego.v1

canonical_payload := {
	"employee_id": "EMP-12345",
	"currency": "EUR",
	"total_amount": "428.50",
}

sink_payload := {"expense": {
	"employee_id": "EMP-12345",
	"currency": "EUR",
	"total_amount": "428.50",
}}

test_allow_map_to_sink if {
	expense.allow with input as {
		"agent_id": "agent-sink-mapping",
		"operation": "expense.map_to_sink",
		"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
		"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
		"input_payload": canonical_payload,
		"output_payload": sink_payload,
	}
}

test_deny_unknown_agent if {
	not expense.allow with input as {
		"agent_id": "agent-rogue",
		"operation": "expense.map_to_sink",
		"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
		"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
		"input_payload": canonical_payload,
		"output_payload": sink_payload,
	}
}

test_deny_schema_mismatch if {
	not expense.allow with input as {
		"agent_id": "agent-sink-mapping",
		"operation": "expense.map_to_sink",
		"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
		"output_schema": {"name": "sink.db.expense", "version": "2.0.0"},
		"input_payload": canonical_payload,
		"output_payload": sink_payload,
	}
}

test_deny_total_amount_change if {
	tampered := {"expense": {
		"employee_id": "EMP-12345",
		"currency": "EUR",
		"total_amount": "999.99",
	}}
	not expense.allow with input as {
		"agent_id": "agent-sink-mapping",
		"operation": "expense.map_to_sink",
		"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
		"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
		"input_payload": canonical_payload,
		"output_payload": tampered,
	}
}

test_deny_currency_change if {
	tampered := {"expense": {
		"employee_id": "EMP-12345",
		"currency": "USD",
		"total_amount": "428.50",
	}}
	not expense.allow with input as {
		"agent_id": "agent-sink-mapping",
		"operation": "expense.map_to_sink",
		"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
		"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
		"input_payload": canonical_payload,
		"output_payload": tampered,
	}
}

test_deny_employee_change if {
	tampered := {"expense": {
		"employee_id": "EMP-99999",
		"currency": "EUR",
		"total_amount": "428.50",
	}}
	not expense.allow with input as {
		"agent_id": "agent-sink-mapping",
		"operation": "expense.map_to_sink",
		"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
		"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
		"input_payload": canonical_payload,
		"output_payload": tampered,
	}
}

test_deny_posting_agent_cannot_map if {
	not expense.allow with input as {
		"agent_id": "agent-sink-posting",
		"operation": "expense.map_to_sink",
		"input_schema": {"name": "expense.canonical", "version": "1.0.0"},
		"output_schema": {"name": "sink.db.expense", "version": "1.0.0"},
		"input_payload": canonical_payload,
		"output_payload": sink_payload,
	}
}